Websites Still Failing Basic Privacy Practices

DigitAl56K writes "Large companies still can't seem to get the basics of privacy and security on the Web pulled together. Today I went to enter a competition from Duracell to win a Nintendo Wii by filling out an online form. It requires entering your full name, address, and date of birth, and then proceeds to submit it via an unencrypted HTTP POST. The ultimate irony is the message at the bottom of the page that reads: 'Trust is a cornerstone of our corporate mission, and the success of our business depends on it. P&G is committed to maintaining your trust by protecting personal information we collect.' Which websites have you found to be lacking in their basic privacy practices?"

Comments

It's a good thing

[XanC]

That Firefox saves the nasty warnings for Web sites that are encrypted!

Re:It's a good thing

[stfvon007]

Well i went to the site and changed http to https, and it brought up the page on an encrypted connection. looks like they aren't forcing you to submit it in the open after all.

Re:It's a good thing

[palegray.net]

While the responsibility does lie with the consumer to take appropriate technical measures to safeguard his personal information, is it too much to ask for a company to make SSL the default when submitting information?

It only takes adding an "s" in the form element...

Re:It's a good thing

[robo_mojo]

It only takes adding an "s" in the form element...

And a valid signed cert, if the site owner doesn't want his users getting annoying warnings...

Re:It's a good thing

[Covener]

When is this "sometimes" you speak of?
If it's >form action="https://server.tld/page.ext"> the data is submitted via https. Period. If you're already on a HTTPS site, a >form action="page.ext"> as enough.
Of course if the site uses JavaScript to read the values and transfer it by other means, that connection should be encrypted too. But if you temporarily disable JavaScript, you're safe.

He surely means in the case the form action explicitly lists http; changing the protocol of the referring page doesn't accomplish anything.

but realistically

[Anonymous Coward]

HTTP is sent unencrypted, but it's not that easy for a random person who wants to steal your address to be on the correct subnet at exactly the right time to sniff it. Also, address and date of birth aren't usually considered confidential, even if you might not want to publish them.

This isn't a lot different than many of those post-card questionnaires many people fill out and mail in.

I think in this case, it's more important what they do with the information once they receive it.

That said, I think there should be default encryption wherever possible automatically.

Re:but realistically

[Anonymous Coward]

I sniffed the password to a Slashdot account! Yours! And I'm using it to post a reply to your post!

Re:but realistically

[blueg3]

That's not at all the birthday paradox.

Re:but realistically

[Anonymous Coward]

I run a copy of Wireshark whenever I'm at a coffee shop, airport lounge, or anywhere else there is a wireless hotspot. You would be amazed at the volume of info that gets sent in the clear - passwords, personal info, you name it. My favorite are people who log onto their webmail using HTTP:// not HTTPS://..... Simple rule I use and push is - if you are on a public (or untrusted) network, use a VPN or SSH tunnel.

Re:but realistically

[jd]

Information is context-sensitive. The VERY first thing you learn when using encryption systems is that it's much easier to crack something where you know what the plaintext should look like. The second thing you learn is that the information around the encrypted data is often far more valuable intelligence-wise than the encrypted stuff. That's why those of you who have ever been instructed on the use of STU-III phones were told NOT to chat before inserting the encryption card. (You WERE paying attention to those talks, right? Right???)

Next, there's this thing called the European Union. They're getting, oh, just a little sensitive about personal information these days. You know, what with German banks freely selling personal data (such as bank account details) to anyone who calls up, despite some of the toughest data protection laws in the world. Americans may view them as unimportant nobodies, but they are at least grasping the idea that ANY unnecessary exposure of personally-identifying information is a very high risk to the individual (identity theft) and a fairly substantial risk to the economy as a whole (such theft costs - and it costs a whole lot more than any "terrorist" threat ever did).

Name and address "high risk information"? If it can be used in a social engineering attack on a bank, credit card company or Government department (and usually such people do not make much effort to validate who a person is), then it is high risk. It doesn't matter if such information has always been viewed as public, as long as human operators (and computer programs) are satisfied that such information proves identity, it is not safe to expose.

Oh, and as for the fact that this information is actually used as a substitute for secure passwords, The Cheshire Catalyst was responsible for publishing a rather pointed song on the subject by breaking into the PRESTEL account of a BBC presenter whilst he was demonstrating the service live on BBC television. The lyrics should be required reading material for anyone who uses any kind of online service, and failure to heed its warnings should be considered no different from reckless driving or setting off fireworks inside a furniture store.

Re:but realistically

[blueg3]

What they're trying to point out is that while it may be rare that anyone is out to steal your personal information, people stealing personal information in general is quite common.

While this may bear a passing resemblance to the birthday paradox, it isn't the birthday paradox. It's like when people claim that X has something to do with relativity. They're almost always wrong. The birthday paradox is a very particular statistical error, and this isn't it. :-)

It's actually easier, anyway, to point out that someone trying to specifically steal "your" credentials just isn't the way it's done. That's a rare attack, because the investment is high compared to the reward. It's far easier to, say, run a credential-harvesting script in a local Starbucks with free wireless every day for a couple of weeks. (It's also rare, though more devastating, to just grab the personal information off of their server.)

Re:but realistically

[Anonymous Coward]

The birthday paradox is a very particular statistical error, and this isn't it.

Yes, it is. The birthday problem is simply this:

Given a set S, what is the probability P(S) that there exist elements (x, y) in S such that x <> y and p(x, y) is true?

The "paradox" comes about because most people misread the above to mean:

Given a set S and an element of the set x, what is the probability P(S, x) that there exists an element y in S such that x <> y and p(x, y) is true?

They're two different problems, but when worded right most people don't recognize that they're different.

Re:but realistically

[holophrastic]

I certainly agree with your first sentiment -- not everything needs to be encrypted. I certainly see the value in encrypting cash and effetively-cash information -- like credit card information. But honestly when it comes to simple privacy information, https is way over-kill. I don't want to slow the web down by 300% just to encrypt everything. Not only is it not necessary -- it's not like packets are intercepted frequently -- but it's by far no where near the weakest link.

I've been to, and photographed, bank machines that use external modems, loose and visible cables, and simple network jacks that could be easily by-passed. You're mail in most physical mailboxes is wide open for viewing. Hey, your licence plate is just sitting in your driveway.

But by far, don't worry about the guy stealing your packets. Worry about the 16 year-old at the gas station that takes your credit card. The secretary at whatever company that answers the phone, the customer service agent. These people are all effectively able to intercept your packets, and you talk to them willingly as customer service for every company you've ever called where you weren't talknig to the owner.

Our industry here is one where the principles of security have matured to the point where it seems like everything needs to be high-security. But in reality, every other industry on this planet is wide open by comparison.

I'm reminded of something as simple as the sign at my local performing arts theatre that reads "no audience members beyond this point", engraved into a plackard beside the door to back-stage. However the door itself is unlocked. I go back after every performance to express my appreciation.

Security for security sake is not only stupid, it's dangerous. It's what had me removing my shoes crossing the border last week. And in the end, after all of the security, I still wound up flying into and out of the U.S. with a knife in my pocket that everyone -- including myself -- missed entirely.

Security is necessary only to the point where something needs securing -- that means it has value, someone wants it, and someone is trying to take it. That last part is vital to the equasion. Securing something that no one is trying to steal is a waste of effort, money, resources, time, and other liberties. You know, like three hours at an airport to take a $35, 25 minute flight.

Re:but realistically

[speedingant]

If information is freely flying through the air, without encryption, does that mean he is doing something wrong?

Re:but realistically

[Library Spoff]

my online dvd rental company (dvdrental.cd-wow.com) emailed me to tell me i needed to update my credit card details - my card runs out at the end of the month. Their ssl cert ran out the end of July. When i contacted them to tell them this they basically said "Don't worry about it, it's all secure, your details don't leave the uk" etc.

As i'll be adding new card info they won't be getting my business until it's fixed...

Re:but realistically

[holophrastic]

a few things. first, the cert has nothing to do with the encryption. the cert isn't a security tihng, it's a third-party vouching system. if you trust the company in the first place, the cert does nothing for you anymore.

as for the actual encryption, if you indeed believe that someone may be intentionally intercepting your transmissions, then yes the encryption is important when transmitting your credit card information. But it's purely a transmission thing. the https encryption only solves someone intercepting packets during transit.

but on the other end, the company has your card information in plain text. you have no control over what they do with it, nor who gets to see it. that's just you trusting them. but you're not just trusting them, you're trusting everyone with physicall access their systems -- like their janitors, and the punk who repairs their chairs.

but in truth, really none of it matters at all because if you're using a major credit card, you aren't responsible for fraudulent charges. they can steal your card, use it a million times, you get the statement, refuse to pay it, and your credit card company deals with the problem. All of the steps that you can take to lessen the risk of credit card theft do absolutely nothing for you -- they just help your credit card company by sparing them the trouble. It was never your problem. That's the benefit of a credit card over interac.

it's funny, all of those horrible credit card anti-fraud things are marketted as though they are features for you, they aren't. they're annoying and aggrevating, and make it more difficult to use the card -- but they save the credit card company time and money. "keeping your card number safe", it was never my card number, it's their card number leslie.

Nobody considers that import

[topham]

That level of privacy is not considered important by anybody. Seriously.

Credit Card data - encrypted; you're first and last name? short of being in the witness protection program it is NOT considered a privacy issue. sorry.

(I know, I know, it would be nice if it was).

Re:Nobody considers that import

[linear a]

The big sites *must* be interested in privacy. They're plastered with security and privacy notices.

Re:Nobody considers that import

[Anonymous Coward]

No, I'm not "first and last name."

Re:Nobody considers that import

[DigitAl56K]

That level of privacy is not considered important by anybody.

It is by me (obviously) ;)

You don't think a name, address, DOB, and password all going plaintext is troublesome? How many people use the same password for half a dozen websites? How many password recovery systems use address or DOB?

With specific regard to "trust", here you have a website asking for a bunch of personal information without taking the most basic precautions to protect it in transit and without an SSL certificate that identifies the owners to inform you where the data might really be going to.

It was enough to make me cancel out.

Re:Nobody considers that import

[tokenturtle]

Exactly. The junk mail that's in my mailbox every day has more detailed information on the outside of the envelope. This is really a non-issue.

Re:Nobody considers that import

[Anonymous Coward]

you're first and last name?

Oh c'mon - it's YOUR not you're

Re:Nobody considers that import

[DigitAl56K]

If your junk mail shows your date of birth and password I'd be worried. It's also a little harder for an observer to collect millions of records from junk mail than it is to sniff at a router and log all the traffic automatically.

BTW what has happened to /. tonight? If Google switched their login page to http would nobody care?

Re:Nobody considers that import

[dreohio99]

Your information is already out there in public records. Google your phone number and see what comes up. If the form asked for SSN or driver's license number I would be a bit more cautious. As far as passwords, it is already considered a bad practice to use the same one on a shopping website as your bank or credit card account websites.

Re:Nobody considers that import

[Zero__Kelvin]

You missed the real story, to wit:

"Internet users still can't seem to get the basics of privacy and security on the Web pulled together. Web users still offer up information they consider to be private and sensitive, on the almost zero chance they will win a Wii, to companies about which they know little or nothing. They still believe the company can and should be trusted with their data, based solely on the fact that the companies products have a little brand recognition ..."

Re:Nobody considers that import

[Kent Recal]

Exactly. This "article" is yet another bad joke (slashdot disappoints a lot lately).

Dear "DigitAl56K": If you're so worried about losing your first and lastname on the interwebs then why the hell do you participate in retarded lotteries?
Here's a little secret: If you don't push that submit button then nobody will ever get your information!

Re:Nobody considers that import

[cycleguy55]

Yeah, the only people that want that level of data are those involved in identity theft. Given the number of people who have had their lives turned upside down through identity theft, we should all be vigilant - including challenging any and all Web sites that don't use proper practices to protect personal information.

Re:Nobody considers that import

[CRC'99]

It's also a little harder for an observer to collect millions of records from junk mail than it is to sniff at a router and log all the traffic automatically.

Riiight - because people can easily sniff traffic at an ADSL DSLAM, wait no, at the L2TP router, wait not even there, oh - at the upstream to a Tier 1 ISP, no, not their either... So where exactly is someone going to sniff your data?

Oh, you're talking about someone on your LAN or Wifi access point? Well then, you have bigger issues!

Even if you're stuck on a cable node, most of the equipment I've seen filter other peoples data out via MAC of the cable modem - so you can't even sniff there...

This being said, where would the so-called 'privacy breech' sniffing take place?

Re:Nobody considers that import

[antic]

Easy publicity for Duracell. Have someone complain about a non-issue with your competition, and get free press.

Re:Nobody considers that import

[telbij]

I don't challenge your thesis, but your example stinks. First of all, the biggest problem as far as privacy is concerned is the database being sold to other companies. The next biggest problem is the database being outright stolen by crackers. Sniffing your POST as it goes across the wire is the least of your worries.

Second, it's just not reasonable to call https standard privacy practice in this case. Standard security practice is to use SSL for "sensitive" information. But it's not standard to consider name, birthdate and address sensitive. You can argue that it should be, but don't try to redefine reality by calling something standard that's not.

Re:Nobody considers that import

[Ash-Fox]

Your information is already out there in public records.

And I know which ones too.

Google your phone number and see what comes up.

Three results, all of which, not even related.

Re:Nobody considers that import

[arminw]

... Given the number of people who have had their lives turned upside down through identity theft...

The thing is though, that if you have your identity stolen, there has to be someone else who ultimately gives something of value to the thief, for that stolen identity. In the case of stolen credit card numbers for example, it would be a bank or merchant that gives the thief of your identity something of value. It is at this point of use, of any identity, stolen or not, that additional security could and should be applied. This should be particularly the case, if the value to be exchanged is very high.

Your identity cannot really be stolen, only fraudulently misappropriated. Your identity is who you are and is one of the few things that cannot be stolen. It is at the point of such misappropriation, the transactional exchange of value, where added security and care would do the most good. You cannot keep your identity, who you really are, a secret, unless you never transact any business with any other person or institution.

Re:Nobody considers that import

[whoisjoe]

I did google my phone number (although I admit that its a mobile phone). All I got were references to the area code and exchange, and one reference to my wireless provider.

White House site

[Anonymous Coward]

Whitehouse.com seems to have no regard for the security of web visitors.

Re:White House site

[bonekeeper]

Nor for the privacy and freedom of speech, actually !

Right...

[Anonymous Coward]

"XXXXX is committed to maintaining your trust by protecting personal information we collect."

Means nothing when every website harvesting your info says that.

Re:Right...

[Ethanol-fueled]

Today I went to enter a competition from Duracell to win a Nintendo Wii by filling out an online form

People actually do that? Legend has it that some folks still fill out meatspace paper rebate forms so that they could wait 60 days to receive a 65-cent check in the mail.

Taxcut http

[Anonymous Coward]

A few years ago I was buying a state tax program and realized that their form that asked for all my private data was an http page! I was shocked. Then I added "s" after http and it happily connected me over SSL. How many people who buy Taxcut will check the protocol and change it?

Re:Taxcut http

[rriven]

It does not matter when you fill the form. As long as when you clicked submit and it went to a https page you are safe.

That is how all the sites that don't handle CC or SSN's do it. It reduces overhead and load time. Even gmail did until recently.

Re:Taxcut http

[SpottedKuh]

It does not matter when you fill the form. As long as when you clicked submit and it went to a https page you are safe.

Now if only you had some assurance that the http-based form hadn't been MitM'ed, such that the "Submit" button no longer submits where you want it to. E.g., if the form were sent over https.

Re:Taxcut http

[FLEB]

Actually, I've heard this discussion come up before-- generally, you want the login form SSL encrypted, as well, to verify the identity and integrity of the form. Otherwise, it leaves the possibility for phishing, poisoned DNS, or a man-in-the-middle attack that rewrites the form to submit to a malicious intermediary. (Granted, a person viewing the code could see that last one, but I know I certainly don't eagle-eye the action param on every form I submit before I hit "go".)

Read The Fine Print

[candude43]

Or the official rules.

Neither Sponsor nor SoftCoin are responsible for lost, late, incomplete, stolen , misdirected or illegible plays, registrations, entries, Code requests, email, postage due mail or replies to Code requests which are returned as undeliverable mail; or for any computer, telephone, satellite, cable, network, electronic or Internet hardware or software malfunctions, failures, connections, or availability, or garbled, corrupt or jumbled transmissions, service provider/Internet/website/use net accessibility, availability, or traffic congestion, or any technical error, or unauthorized human intervention , or the incorrect or inaccurate capture of registration, Code, entry or other information, or the failure to capture, or loss of, any such information. Neither Sponsor nor SoftCoin are responsible for any incorrect or inaccurate information, whether caused by Website users, tampering, hacking, or by any of the equipment or programming associated with or utilized in the Promotion and assume no responsibility for any error, omission, interruption, deletion, defect, delay in operation or transmission, communications line failure, technical error, theft or destruction or unauthorized access to the Promotional Website.

It's hard to believe that they are "committed to maintaining your trust by protecting personal information" when they disavow any responsibility if it's stolen. But I think that's pretty standard boilerblate.

Ignorance at work

[horatio]

Many, many people that I've tried to talk to about this very thing completely don't understand encryption at the most basic level - why it matters or if they have it. My guess from past experience is that if you tried to talk to P&G about it, the people responsible would try to tell you that it didn't need encryption, because the site is on *their* servers, so the data only goes on their network, and no amount of convincing would get them to think otherwise. The site you mentioned was probably farmed out anyways.

The state of affairs when it comes to the most basic data protection is really sad. One case was where I was applying for a job which required my SSN (a federal gov't position). The instructions were to download the form and email it. I called the number listed and explained why I wasn't going to include my SSN in an email, and they weren't mad, but they were annoyed. So you tell me a) did they wait for my app and trash it because I put "withheld for security reasons, will provide offline" (something like that) b) if the folks running the federal jobs website think it is okay to email around sensitive information (this was another one of those "your email is stored in our secure servers" things), then it must be okay, right?

Even in the physical realm, things aren't much better. A couple of months ago, I called a local business to complain that they'd charged my creditcard a fee for canceling an appointment. (The number shouldn't be on file, I know. At the time I didn't realize that it was.) I explained to the person that when I canceled the appointment I was aware of the fee, but to send me a bill for it and I'd pay it when I got the bill. They sent me an invoice in the mail, with the charges and showing the balance was paid. I asked the guy which credit card they'd charged - and he proceeded to read off the type, entire number, and expiration date - without any authentication from me except my name and one other non-secret item, derived from the start of the conversation. I've since canceled that card, but people really don't understand.

Re:Ignorance at work

[Ritchie70]

Afraid I don't understand actually.

OK, the merchant shouldn't have your card # on file.

But wait, actually, according to my understanding of current PCI rules, they can have it on file, so long as it's secure from hacking. Not fraud, hacking.

Fraud = an employee steals the number or is fooled into giving it away.
Hacking = IT security breach causes the loss.

So if they wrote it on a piece of paper and put it in a file drawer, it's fine.

If it's in electronic format, that's something they have to prove is secure - or, assuming they're a minor merchant, they have to claim is secure.

Now, we all know how easy it is to fool someone into giving you the card number, but once again, that would be fraud, and is not really covered by the PCI standard afaik.

Don't blame P&G or Duracell

[bugs2squash]

It probably wasn't really their website you were entering your details into anyway...

Email address already in use

[teh moges]

I put in some fake credentials to test it out, but unfortunately the email address asdf@asfd.com was already in use...

"maintaining your trust"

[iminplaya]

How can they maintain something they'll never have?

Name, Address and Dob are a joke

[jbsooter]

"It requires entering your full name, address, and date of birth, and then proceeds to submit it via an unencrypted HTTP POST"

If I wanted a list of names, birth dates and addresses to use for nefarious purposes I don't need to steal yours from some dinky website or sniff packets. I'd just take one of the plentiful lists of birth records on the internet like this one then cross reference it with property tax records of the area which are more plentiful than the birth records and it'll give probable name, dob, and address combinations. A good portion of probable matches can be confirmed through freely available court records. All of that data is fairly trivial to collect in bulk (i used to collect databases, was a pretty fun hobby actually), is perfectly legal and will provide a much better profile of matches than just name/dob/addr combinations stolen from a website or data stream.

Being that anal about your name, birth date and address is actually quite silly. Theres so much low hanging fruit as far as collecting that type of data is concerned (and you're probably already included in it) that all you really did by not continuing with that form was taking yourself out of the running for a Wii.

The best thing you can really do is just keep close tabs on your credit report and get signed up for all the fraud alerts or freezes they offer. Thats the best place to prevent and quickly repair most identity theft. Stop being so anal about info thats almost guaranteed to be out there already, set up your defenses where they're most effective and go get your Wii.

Stopped using SSL

[Ash-Fox]

I stopped providing security on my websites when browsers made it too difficult for the average user (that I deal with) to continue using the site with a self signed certificate.

Sure, it won't help against a man in the middle attack. But that is truly the only attack that using self signed certificates is vulnerable to. Unlike completely unencrypted content.

If godaddy, verisign etc. didn't charge insane prices like £107 per year for a wildcard certificate for one domain, I would do actually buy the certificates needed. I already find 10USD too much for a wildcard certificate for the numerous domains I operate, so it would have to be quite a significant drop. It's not like they do any verification with the £107 certificates, they just want a credit card number.

Sallie Mae e-mailed me my SSN number regularly

[knifeyspooney]

They stopped this practice recently, but for over a year, my student loan company required me to sign up for monthly paperless statements if I wanted to pay electronically. The statements were e-mailed in the form of a PDF attachment. The e-mail body assured me my privacy was intact because the file was password protected -- by my Social Security number!

Brilliant! If an interloper intercepted my e-mail, not only could he brute force my password with easy to find, easy to use tools (in a matter of minutes, since he knows the number of characters in it), but he'd know my SSN once he cracked it. I would have been better off with no password protection.

When I e-mailed Sallie Mae with the above information, the representative brushed it off. It was safe, he said, as long as I opened it on a non-public computer, because my SSN was not being sent over the Internet when I typed it in.

(The Consumerist didn't find it interesting, either.)

Re:Sallie Mae e-mailed me my SSN number regularly

[mpaulsen]

It's not hypothetical. SallieMae has sent that email to the wrong person, and it did prove to be easy to crack. In fact, your post sounds an awful lot like... http://www.ownrecognizance.com/salliemae.html

They stopped this practice recently
Do you have any details? I'd like to see their announcement of the change.

slashdot

[blitzkrieg3]

What about slashdot? Strangely there is no https://slashdot.org/login.pl, even though here is a https://slashdot.org/my/logout. You can logout with SSL, you just can't log in with it.

Re:slashdot

[blitzkrieg3]

Except that doesn't make any sense. How do they know you're a subscriber when you haven't logged in yet?

What the OP fails...

[BrokenHalo]

...to mention is that the whole point of a lot of those online forms (such as competitions etc) is to provide an opt-in to any kind of marketing dreck the the site owner (or any of his mates) cares to send you.

The best way to keep your personal information private is to not hand it out. I know that should be obvious, but the fact seems to escape people when they appear to be being offered free ponies (or whatever).

Suggestion: OpenVPN

[toby]

is a great solution (Windows, OS X, Linux, *BSD, Solaris, etc). Once you've started the daemon, it's available everywhere you go, transparently. Just proxy your web surfing, mail access through the VPN server.

(Of course in the FA's example, it only encrypts half of the transmission - to your proxy - but it's these edge networks that are generally most vulnerable - home wireless, Starbucks, random offices, hotels, airports and local ISPs. That said, never forget the NSA is listening on core networks.)

And after the SSL form?

[Beltway Prophet]

Beween 1999 and 2001 I worked at a local Washington, DC ISP, and I was impressed with the number of sites we hosted that carefully encrypted their customers' credit card information as it traveled to our server racks, then delivered it to the site operators by plaintext email to an AOL account.

Sure, times have changed, but short of auditing the offices of your favorite e-commerce sites, how do you know what they do with your data after you carefully check that all their forms submit with "https://"?